Re: [patch] fix syscall speedup patch mips typo

From: Linda Knippers <linda knippers hp com>

To: Steve Grubb <sgrubb redhat com>

Cc: linux-audit redhat com

Subject: Re: [patch] fix syscall speedup patch mips typo

Date: Wed, 15 Mar 2006 14:43:39 -0500

> Steve Grubb wrote:
>
>> On Wednesday 15 March 2006 12:39, Linda Knippers wrote:
>>
>>> When is a SYSCALL_PARTIAL emitted, vs a SYSCALL?
>>
>> Whenever there are no audit rules loaded and an AVC message is
>> triggered. We just grab what's readily available which means we don't
>> have the arch, syscall, or args. Everything else should be there.
I also don't understand how this is related to improving performance
when there are no audit rules. It seems like it doubles the cost of
an AVC message.
-- ljk